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DETAILED ACTION 

1 . This action is responsive to the non-provisional application filed on April 14, 
2004. Claims 1 -27 are pending. Claims 1, 13, 19, 23, and 27 are independent. 

Specification 

2. The abstract of the disclosure is objected to because it is longer than the 
maximum 150 words. Correction is required. See MPEP § 608.01(b). 

Claim Objections 

3. Claims 4 and 8 are objected to because of the following informalities: the 
applicant makes reference to "a result the checks". It is assumed this is a typo and "the 
result of the checks" was intended. Appropriate correction is required. 

Claim Rejections - 35 USC § 101 

4. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

Claim 27 is rejected under 35 U.S.C. 101 because the claimed invention is directed to 

non-statutory subject matter. Claim 27 is directed to a data structure, which does not 

fall into one of the four statutory categories. 
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Claim Rejections - 35 USC § 102 

5. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1 ) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351 (a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 



6. Claims 1 - 3, 6, 7, 10 - 14, 18, 23 and 24 are rejected under 35 U.S.C. 102(e) as 
being anticipated by Conrad Herrmann et al's US Publication 2004/0107360. Referring 
to claim 1 , Herrmann teaches: 

a. A client seeking access to a network (page 7, paragraph 63). 

b. A policy server that performs checks to confirm the client meets with 
applicable rules (page 8, paragraph 69). 

c. An Integrity Gateway (IGW) server that allows access to those with the 
appropriate configuration and denies access to those without it (page 8, 
paragraph 67). 

7. Referring to claim 2, Herrmann teaches checking for installed virus software 
(page 8, paragraph 68). 

8. Referring to claim 3, Herrmann teaches that delegates on the client computer 
perform the security checks (page 11-12, paragraph 94). 
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9. Referring to claim 6, Herrmann teaches that if the client fails the checks that the 
client is notified how to correct the problem (page 12, paragraph 97). 

10. Referring to claim 7, Herrmann teaches that the client is directed to the second 
server after the checks are failed (page 12, paragraph 96). 

1 1 . Referring to claim 10, Herrmann teaches that after an inventory of software 
(security policy check), that the server redirects the client to a website to download the 
appropriate fix (page 10, paragraph 79). 

12. Referring to claim 1 1 , Herrmann teaches that the policy server acts as a 
mediator between the client and the second server (figure 4) and acts as a firewall for 
the IGW (page 8, paragraph 69). 

13. Referring to claim 12, Herrmann teaches that the first and second server can be 
part of the same computing device (page 8, paragraph 69). 

14. Referring to claim 13, Herrmann teaches: 

d. Receiving a manifest of checks from the policy server that determine a 
configuration (page 11, paragraph 94). 

e. Performing the checks and forwarding the results to the policy server 
(pages 11-12, paragraph 94). 

f. The client connects to the NAS to request access (page 7, paragraph 63) 
which forwards the request to the IGW server (page 8, paragraph 66). 

g. The client's proof of configuration is forwarded through the first server to 
the second server (page 12, paragraph 95). 

15. Referring to claim 14, Herrmann teaches: 
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h. Receiving a request for software inventory from the first server (page 8, 
paragraph 68). 

i. Receiving the software necessary and installing it (page 10, paragraph 
79). 

16. Referring to claim 18, Herrmann teaches that the first and second server can be 
part of the same computing device (page 8, paragraph 69). 

17. Referring to claim 23, Herrmann teaches: 

j. Receiving request to access a network resource (page 7, paragraph 63). 
k. Receiving proof of a required configuration (page 1 2, paragraph 95). 
I. Comparing the proof to information obtained (page 12, paragraph 96). 
m. If the proof is valid, access is permitted, if invalid then access is denied 
(page 12, paragraph 97). 

18. Referring to claim 24, if the proof is invalid the client is directed to download the 
appropriate fix to the problem (page 12, paragraph 97). 

Claim Rejections - 35 USC § 103 

19. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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20. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 
USPQ 459 (1966), that are applied for establishing a background for determining 
obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

Claims 4, 5, 15, 16, 19 -22, and 25 are rejected under 35 U.S.C. 103(a) as being 

unpatentable over Herrmann in view of Yoko Saito et al's US Patent 6,275,941 . 

Referring to claims 4, 5, 15, 16, and 25 Herrmann discloses all the limitations of the 

parent claims and the passing of the response back to the server (page 12, paragraph 

94). Herrmann does not appear to explicitly disclose issuing a certificate and storing it in 

a database. However, Saito discloses: 

n. Issuing a certificate to the client (column 5, lines 21-22), 

o. Passing the certificate to the server for authentication (column 7, lines 21 - 

23), 

p. Comparing the certificate to the original (column 7, lines 33-35). While it 
does not explicitly disclose that the certificate is stored, it is inherent from the 
ability to compare it to the original. 
Steps n and p above teach claim 4. Steps o and p above teach claim 5. Step n above 
teaches claim 15. Step o above teaches claim 16. Step n teaches claim 25. 

21 . Referring to claim 1 9, Herrmann discloses: 
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q. Sending a manifest of checks to the client to prove the required 
configuration (page 8, paragraph 67). 

r. Receiving the result of the checks (page 9, paragraph 76). 
s. Once the client passes the checks, Saito discloses: 

i. Issuing a certificate to the client (column 5, lines 21-22) 

ii. Comparing the certificate to the original (column 7, lines 33-35). 
While it does not explicitly disclose that the certificate is stored it is 
inherent from the ability to compare it to the original. 

iii. Making the certificate available to the server controlling network 
access (column 7, lines 36-38). 

22. Referring to claim 20, Herrmann teaches that if the client fails the checks that 
the client is notified how to correct the problem (page 12, paragraph 97). 

23. Referring to claim 21 , Saito teaches issuing a certificate to the client (column 5, 
lines 21-22). 

24. Referring to claim 22, Herrmann teaches that an inventory of software (security 
policy check) is sent (page 8, paragraph 67), the results are received and if they fail, 
then the server redirects the client to a website to download the appropriate fix (page 
10, paragraph 79). 

25. Herrmann and Saito are analogous art because they are from the same field of 
endeavor, security management. At the time of the invention, it would have been 
obvious to one of ordinary skill in the art, having the teachings of Herrmann and Saito 
before him or her, to modify Herrmann to include certificates and storage of Saito. The 
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motivation for doing so would have been that you can use single sign on (column 1 , 
lines 50-51). Therefor it would have been obvious to combine Saito with Herrmann to 
obtain the invention as specified in the instant claims. 

Claims 8, 9, 17, 26 and 27 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Herrmann, and further in view of Saito and Jingsha He et al's US Patent 
6,088,451. Referring to claims 8, 9, 17, and 26 Herrmann discloses all the limitations of 
the parent claim. Herrmann does not appear to explicitly disclose issuing a certificate, 
and storing it in a database and using a unique identifier to identify the storage. 
However, Saito teaches: 

t. Issuing a certificate to the client (column 5, lines 21-22), 

u. Passing the certificate to the server for authentication (column 7, lines 21- 

23), 

v. Comparing the certificate to the original (column 7, lines 33-35). While it 
does not explicitly disclose that the certificate is stored, it is inherent from the 
ability to compare it to the original. 

w. Storing the certificate in a second database as well (column 8, lines 53- 
54). 

Herrmann and Saito are analogous art because they are from the same field of 
endeavor, security management. At the time of the invention, it would have been 
obvious to one of ordinary skill in the art, having the teachings of Herrmann and Saito 
before him or her, to modify Herrmann to include certificates and storage of Saito. The 
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motivation for doing so would have been that you can use single sign on (column 1, 
lines 50-51). Therefor it would have been obvious to combine Saito with Herrmann. 
Hermann in view of Saito fails to disclose storing a unique identifier for the certificate. 
However, He goes on to teach: 

x. storing a unique identifier for a user (column 16, lines 28-29). 

26. Steps t, w and x teach claim 8. Steps t, v, w and x teach claim 9. Where step v is 
executed using the unique identifier taught by step x. Step v is executed using the 
unique identifier of step x teaches claims 17 and 26. 

27. Herrmann in view of Saito and He are analogous art because they are from the 
same field of endeavor, network security. At the time of the invention, it would have 
been obvious to one of ordinary skill in the art, having the teachings of Herrmann, Saito, 
and He before him or her, to modify Herrmann in view of Saito with the unique identifier 
of He. The motivation for doing so would have been that you can maintain a universal 
standard (column 1 , lines 48-50). Therefor it would have been obvious to combine He 
with Hermann in view of Saito to obtain the invention as specified in claims 8, 9, 17 and 
26. 

28. Referring to claim 27, Herrmann teaches that a manifest of checks was 
performed for a specific security policy (page 8, paragraph 68). Hermann does not 
appear to explicitly disclose issuing a certificate. However, Saito goes on to teach 
issuing the certificate (column 5, lines 21-22) comprising: 

y. The term of availability (column 7, lines 29-30). It is inherent that creation 
time and expiration time would be included in this. 
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z. A policy (manifest) number indicating which policy the client is approved 

for (column 6, lines 51-52). 
Herrmann and Saito are analogous art because they are from the same field of 
endeavor, security management. At the time of the invention, it would have been 
obvious to one of ordinary skill in the art, having the teachings of Herrmann and Saito 
before him or her, to modify Herrmann to include certificate of Saito. The motivation for 
doing so would have been that you can use single sign on (column 1, lines 50-51). 
Therefor it would have been obvious to combine Saito with Herrmann. Hermann in view 
of Saito fails to disclose storing a unique identifier for the certificate. However, He goes 
on to teach using a unique identifier (column 16, line 28-29). 

29. Herrmann, Saito and He are analogous art because they are from the same field 
of endeavor, network security. At the time of the invention, it would have been obvious 
to one of ordinary skill in the art, having the teachings of Herrmann, Saito, and He 
before him or her, to modify Herrmann in view of Saito with the unique identifier of He. 
The motivation for doing so would have been that you can maintain a universal standard 
(column 1 , lines 4850). Therefor it would have been obvious to combine He with 
Hermann in view of Saito to obtain the invention as specified in claim 27. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Cordelia Kane whose telephone number is 571-272- 
7771 . The examiner can normally be reached on Monday - Thursday 8:00 - 5:00 EST. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Joseph Del Sole can be reached on 571-272-1130. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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